{"push_id":1493071433,"size":31,"distinct_size":31,"ref":"refs/heads/tls1_3-cert-verify","head":"55aff04f969a18eed81bf63ac86c32028c1ef26c","before":"9b14df5bea1a3d5475ec2f138f7b8a42daee67c7","commits":[{"sha":"290a0419f0c13a30fb3a1d1a279125c8aeafd17e","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Mark a HelloRequest record as read if we ignore it\n\nOtherwise the client will try to process it again. The second time around\nit will try and move the record data into handshake fragment storage and\nrealise that there is no data left. At that point it marks it as read\nanyway. However, it is a bug that we go around the loop a second time, so\nwe prevent that.\n\nReviewed-by: Rich Salz <rsalz@openssl.org>\n(Merged from https://github.com/openssl/openssl/pull/2200)","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/290a0419f0c13a30fb3a1d1a279125c8aeafd17e"},{"sha":"acf14977367c661261ada70064506bf617bbe026","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Add a TODO(TLS1.3) around certificate selection","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/acf14977367c661261ada70064506bf617bbe026"},{"sha":"728298fdf081fe5ee33be639b1af79fb794047d1","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Move Certificate Verify construction and processing into statem_lib.c","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/728298fdf081fe5ee33be639b1af79fb794047d1"},{"sha":"2502341f2a24747658c4ecd3f391a0c9a7c542d2","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Make CertificateVerify TLS1.3 aware","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/2502341f2a24747658c4ecd3f391a0c9a7c542d2"},{"sha":"c5de1e63ee912c812b8bd0e3e5f2c5564be76a19","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Sign CertificateVerify messages using PSS padding","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/c5de1e63ee912c812b8bd0e3e5f2c5564be76a19"},{"sha":"ae1e0f2d1fd94261b0a64ced2128dd5c7d0187dd","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Convert Sigalgs processing to use ints\n\nIn TLSv1.2 an individual sig alg is represented by 1 byte for the hash\nand 1 byte for the signature. In TLSv1.3 each sig alg is represented by\ntwo bytes, where the two bytes together represent a single hash and\nsignature combination. This converts the internal representation of sigalgs\nto use a single int for the pair, rather than a pair of bytes.","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/ae1e0f2d1fd94261b0a64ced2128dd5c7d0187dd"},{"sha":"ef8800619eff220cd9f2f9a6d238b1653158b265","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Remove a redundant function\n\nThe extensions refactor made this function redundant so we can remove it.","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/ef8800619eff220cd9f2f9a6d238b1653158b265"},{"sha":"0df598ead0991c6ede5415a60e66cb6332475680","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Use NIDs instead of the old TLSv1.2 sigalgs hash and sig ids\n\nWe had an extra layer of indirection in looking up hashes and sigs based\non sigalgs which is now no longer necessary. This removes it.","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/0df598ead0991c6ede5415a60e66cb6332475680"},{"sha":"f039e05cb83073c3a8807e501ed01e13edd1db5d","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Remove some unneeded functions\n\nThe sigalgs work has made some old lookup tables and functions redundant\nso remove them.","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/f039e05cb83073c3a8807e501ed01e13edd1db5d"},{"sha":"239caf30821c4f5c3b08bee17633aba0ce976f59","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Ensure the record sequence number gets incremented\n\nWe were not incrementing the sequence number every time we sent/received\na record.","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/239caf30821c4f5c3b08bee17633aba0ce976f59"},{"sha":"e423ce5be304422e0be1a1481fda2ea4cd8c3044","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Use the correct size for TLSv1.3 finished keys\n\nWe need to use the length of the handshake hash for the length of the\nfinished key.","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/e423ce5be304422e0be1a1481fda2ea4cd8c3044"},{"sha":"dd0210a9e07f448b46c75d919fbebbb431d2619a","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Temporarily ignore NewSessionTickets for TLS1.3\n\nWe can't handle these messages yet, so ignore them for now.","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/dd0210a9e07f448b46c75d919fbebbb431d2619a"},{"sha":"f41c23e45fd17e30b562b7d10e1dcb0d2a554a3d","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Fix client application traffic secret\n\nA misreading of the TLS1.3 spec meant we were using the handshake hashes\nup to and including the Client Finished to calculate the client\napplication traffic secret. We should be only use up until the Server\nFinished.","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/f41c23e45fd17e30b562b7d10e1dcb0d2a554a3d"},{"sha":"fc71b6a45a5ff460dc78de8b7406df4deea5d9a1","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Verify that the sig algs extension has been sent for TLSv1.3","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/fc71b6a45a5ff460dc78de8b7406df4deea5d9a1"},{"sha":"77277cb0204d5541811daaccb9adc3c31394f08b","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Ignore PKCS1 based sig algs in TLSv1.3\n\nIn TLSv1.3 we must use PSS based sig algs for RSA signing. Ignore any\nshared sig algs which are PKCS1 based.","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/77277cb0204d5541811daaccb9adc3c31394f08b"},{"sha":"aa4535fbde72eb00fd5d43b759809f21f4a31b44","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Add some sig algs tests","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/aa4535fbde72eb00fd5d43b759809f21f4a31b44"},{"sha":"1293c96f070db17a99a564fcea39766a5318df40","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Add a TLS1.3 TODO for setting of sig algs","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/1293c96f070db17a99a564fcea39766a5318df40"},{"sha":"1eb8752052220a24ece29b8510db4829473a06f3","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Always use TLSv1.0 for record layer version in TLSv1.3\n\nTLSv1.3 freezes the record layer version and ensures that it is always set\nto TLSv1.0. Some implementations check this.","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/1eb8752052220a24ece29b8510db4829473a06f3"},{"sha":"651e03b28e0c17e3c2040a3536e47432e21ec643","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Fix test_sslversions to know that TLSv1.3 sets record version to TLSv1.0\n\nThis also acts as a test for the bug fixed in the previous commit.","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/651e03b28e0c17e3c2040a3536e47432e21ec643"},{"sha":"0110d2fe5009e97f966ef2b0043ace7ff24f3121","author":{"name":"Matt Caswell","email":"31e7b35f7f9f5d76c1e2ef239c79b97264b2f6d0@openssl.org"},"message":"Extend PSS signature support to TLSv1.2\n\nTLSv1.3 introduces PSS based sigalgs. Offering these in a TLSv1.3 client\nimplies that the client is prepared to accept these sigalgs even in\nTLSv1.2.","distinct":true,"url":"https://api.github.com/repos/mattcaswell/openssl/commits/0110d2fe5009e97f966ef2b0043ace7ff24f3121"}]}
{"actor":{"display_login":"mattcaswell"}}